This is an automated email from the ASF dual-hosted git repository. potiuk pushed a commit to branch hardened-python-base-images in repository https://gitbox.apache.org/repos/asf/airflow.git
commit 0a4e88d64a051421445576f2b405421dd5d80dc0 Author: Jarek Potiuk <[email protected]> AuthorDate: Sat Oct 10 13:32:57 2026 +0100 Trust Microsoft's newer signing key for the trixie MSSQL repository Microsoft signs its Debian 13 package repository with its 2025 general signing key rather than the 2015 release key, so apt on trixie rejected the repository as unsigned. Generated-by: Claude Opus 5 Claude-Session: https://claude.ai/code/session_014np1fVAxHmGaBFt3qebJ8x --- Dockerfile | 2 ++ Dockerfile.ci | 2 ++ scripts/ci/prek/update_docker_gpg_keys.py | 2 ++ scripts/docker/install_mssql.sh | 2 ++ scripts/docker/keys/microsoft-2025.asc | 29 +++++++++++++++++++++++++++++ 5 files changed, 37 insertions(+) diff --git a/Dockerfile b/Dockerfile index b42423b85c1..92eafdcc8ae 100644 --- a/Dockerfile +++ b/Dockerfile @@ -829,6 +829,8 @@ function install_mssql_client() { packages=("msodbcsql18") common::import_trusted_gpg "EB3E94ADBE1229CF" "microsoft" + # The Debian 13 repository is signed with Microsoft's newer key, the older releases with the one above. + common::import_trusted_gpg "EE4D7792F748182B" "microsoft-2025" echo echo "${COLOR_BLUE}Installing mssql client${COLOR_RESET}" diff --git a/Dockerfile.ci b/Dockerfile.ci index a46c40712fb..39cd72626e0 100644 --- a/Dockerfile.ci +++ b/Dockerfile.ci @@ -765,6 +765,8 @@ function install_mssql_client() { packages=("msodbcsql18") common::import_trusted_gpg "EB3E94ADBE1229CF" "microsoft" + # The Debian 13 repository is signed with Microsoft's newer key, the older releases with the one above. + common::import_trusted_gpg "EE4D7792F748182B" "microsoft-2025" echo echo "${COLOR_BLUE}Installing mssql client${COLOR_RESET}" diff --git a/scripts/ci/prek/update_docker_gpg_keys.py b/scripts/ci/prek/update_docker_gpg_keys.py index 37eee4e1e32..30c7e93b9d6 100755 --- a/scripts/ci/prek/update_docker_gpg_keys.py +++ b/scripts/ci/prek/update_docker_gpg_keys.py @@ -41,6 +41,8 @@ KEYS: dict[str, str] = { "postgres": "7FCC7D46ACCC4CF8", # Microsoft APT repository signing key (MSSQL ODBC) "microsoft": "EB3E94ADBE1229CF", + # Microsoft signs the Debian 13 (trixie) repository with its newer general signing key + "microsoft-2025": "EE4D7792F748182B", } diff --git a/scripts/docker/install_mssql.sh b/scripts/docker/install_mssql.sh index 94abe6c7655..b1786006114 100644 --- a/scripts/docker/install_mssql.sh +++ b/scripts/docker/install_mssql.sh @@ -38,6 +38,8 @@ function install_mssql_client() { packages=("msodbcsql18") common::import_trusted_gpg "EB3E94ADBE1229CF" "microsoft" + # The Debian 13 repository is signed with Microsoft's newer key, the older releases with the one above. + common::import_trusted_gpg "EE4D7792F748182B" "microsoft-2025" echo echo "${COLOR_BLUE}Installing mssql client${COLOR_RESET}" diff --git a/scripts/docker/keys/microsoft-2025.asc b/scripts/docker/keys/microsoft-2025.asc new file mode 100644 index 00000000000..d6381a08150 --- /dev/null +++ b/scripts/docker/keys/microsoft-2025.asc @@ -0,0 +1,29 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGVUhiwBEADF3TWX0HMi2+BdQfJrSdQkZTE4qk4vV2ooAMn8vWA2DGI88JOl +k1LwhZGEqJv5TsKTyNEMWb3NXhR1ZZ5uQPvf6iN0806cq83s096F85GUtjzfGLQj +Zo3FhDSKeHz3mhthQ4QP4bwYUmSpWs6e+/ZSFYYc3yU8mInDM4SNzrqr4x2ltmf+ +3RWkoYYo1SpG521A9+1zi7xzz6IHpAk6MdIcTj7mHxXd6ovmXkvHUhKbXGkybHPn +iupWokDaJZgV4+q6kc7zVgTVnwmXV7NHQhWSyOm/BmYVcpmrkCSgSH18SArFjR6Q +KyJ9VuUo1mJEUGnEakQSaOn1UAYtO8Mh4cXXD4833G0BLjiFNOL0XRUNh35pKvcT +my/HnXvRXtpzAzTtANPxIbjli/veagU+JRWhtjtfONz0wQ5Bv1zFjnM9ewxFNPPo +7Jp9WCVeUKFZcZJo8r/k7Y4d0Y1WINOPniSCNhKcD0pva3gXLcxfdnZjdMSj++ba +XlAstjw0Oyty0EXoHXCMpelMoa+DQ7KSDGKrOtm5YFAP6Ki4go1Tt2q8nmul36cZ +Zot6eoPG/qKxW+dvmSrWhQCcfd74VbhECbzXiCFLHadq85C1K5rrLM6oVr1u7K6O +jlc1aitGgZECi6fvu61QhpUvHjCegRWzMIhah9qrv4lvxFFcA+a1jwXlnwARAQAB +tEJNaWNyb3NvZnQgQ29ycG9yYXRpb24gLSBHZW5lcmFsIEdQRyBTaWduZXIgPGdw +Z3NpZ25AbWljcm9zb2Z0LmNvbT6JAjgEEwEIACIFAmVUhiwCGwMGCwkIBwMCBhUI +AgkKCwQWAgMBAh4BAheAAAoJEO5Nd5L3SBgrDc0P/0Ubx0vqD/DgyhiP0bIs8euO +iA5BQvOCiroIkhSkFbAw8rT9a/XtRTRM2l4I8c2M1ZX9i/0wWihmFUJhiVHyRxkl +ZcEFv+ieBuhvD1gPOVLZg3To8yOTrcOnHe+FuKqA6u+3xBn2AmAWeck9o0NKhtnm +5ckweos+Qj9NoxaZX8UeGFstOiTBJeyhuJjthQ+3M0BvTxEaRcLXGSXSGSgZ00ii +YSLNgOMPF+C22bXBL/erClEYkIGCctqPvyrhV/GVNnGk2ALyJqdK+BaJeGh9mBJa +ZrP3l6vFxsAI0RNCNU1s5QaFzfFzFkiUnG/aoyuwh4xmsB+uyVkR+KigPK9gfF3S +nU7AqcdhSbUA6A0DGDRkHauHM5Wtc7730LdjiNDXbYwG/yXmDYNasoszmItZzh77 +HiQxYA5dNB9r9QJS2rHV/qe+heAJ5Rub5kxcu33DGL30qG7Q9+HRTu0oSEOIUFyT +aOJJnNUiB2D4hoKKnr5U8FYOZ7KvDcG7cDvInqYtGpNfrnIf94VeB9WJY6DbDQSA +F5yHb6X8FS0x3lMT2H1l6RRyr0278kyO18VBudtlnonC+Y1UT7eqAk6WjS5CitPX +T3Hc7jCURugXrc51igKa+p67yAaybEIuVyWF6JaINKRqiUqEPVXnHELXPbBmiHW5 +1HwdbKTMzgF8bu1JI+tQ +=lIzW +-----END PGP PUBLIC KEY BLOCK-----
